-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 3.0 (quilt) Source: icecast2 Binary: icecast2 Architecture: any Version: 2.4.0-1.1+deb8u1 Maintainer: Debian Multimedia Maintainers <[email protected]> Uploaders: Guillaume Pellerin <[email protected]>, Romain Beauxis <[email protected]>, Jonas Smedegaard <[email protected]>, Unit 193 <[email protected]> Homepage: http://www.icecast.org/ Standards-Version: 3.9.5 Vcs-Browser: http://anonscm.debian.org/gitweb/?p=pkg-multimedia/icecast2.git Vcs-Git: git://anonscm.debian.org/pkg-multimedia/icecast2.git Build-Depends: cdbs (>= 0.4.70~), autotools-dev, devscripts, libtool, automake1.11, autoconf, debhelper (>= 9), dh-buildinfo, libogg-dev (>> 1.0.0), libvorbis-dev (>> 1.0.0), libxslt1-dev | libxslt-dev, libxml2-dev, libcurl4-gnutls-dev, libtheora-dev (>= 0.0.0.alpha7), libspeex-dev, po-debconf, autoconf-archive Package-List: icecast2 deb sound optional arch=any Checksums-Sha1: 45bd403c2b1d6f1250216cd3a0447d41f979c348 1087795 icecast2_2.4.0.orig.tar.gz 321ebb03bbd744f70bbf056a0d3c6c3e6a430769 29592 icecast2_2.4.0-1.1+deb8u1.debian.tar.xz Checksums-Sha256: 17b7e957e1b16a576efaabd69c15126e84ce98d3791ccee4546b72c0c6460f32 1087795 icecast2_2.4.0.orig.tar.gz 895acd7bd62ab3fa83bcd254335f83d89c76ef30b06df71cc4316c459ae767ca 29592 icecast2_2.4.0-1.1+deb8u1.debian.tar.xz Files: bb00bfc0d6d2dde24974641085602b81 1087795 icecast2_2.4.0.orig.tar.gz 726dc90c578d792542bb9423795a20ef 29592 icecast2_2.4.0-1.1+deb8u1.debian.tar.xz -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBCgAGBQJVQK1GAAoJEK+lG9bN5XPLagkP/0VsyR4itmZYAsMwHZFUV3/l dXusqgzJlehgy7wdOmDvm230BALVsIVaDF++sGs74UaYwR3JpM+KEMxz1VJ9aq7O ch7OEBHES/PSfywmPv/+DLvhb7L8NFPQy9yeL/JwsJQyoesgmtU2x6UrciXRvfP3 klUPrtcq7KMM817B/a+6V4JiAARVymXBG10BhhKfquF3ANiS5jLuE3LJkPAV0K4d Gs40jptZ7h/sJNQhpGAKCC0ryc78c+uBGYDe7s6X+uOHHogKSXa53S02HGmPLK9K f9eBoAAwz9Yyy5LNuMbkMyS15HFnquy6PRlB8wneM29Nhz9nzXFH3Y1k39sl7tXO QxGKBOF3NQd8q+CG0HnKk5BhnBqPToR9IPE+7vb15trvNY5aZTcXugZcQ7wCPjcI Q2oIYLYAy2pFf1NK3Il//wkWN3nSsNlX5kfcHnw2cfIH4C5fEMxglMsj4ETu85ld jODWJh1pi5nMzBoV+Iv1uo4jWeLgeuy78qKsgNc5fcUjEDIqONpk+6Cykvdx9lQ+ cHimX8yaHq/Xgj9mttQsPz0mBq4MM+DG6M9kRSAdS9VmKK5oYIMXnNoRfsvJXyUM 6P7/OgyA8HbdaMAYnF9x+3xzLJQJFo7ITCSvfextotD/Mb/93CDIbpEy7gsXP6sV ipFm5AKYqRksaAuNVLJJ =W4MR -----END PGP SIGNATURE----- Changes: icecast2 (2.4.0-1.1+deb8u1) jessie-security; urgency=high * This fixes a crash (NULL reference) in case URL Auth is used and stream_auth is trigged with no credentials passed by the client. Username and password is now set to empty strings and transmited to the backend server this way. (Closes: #782120, fixes CVE-2015-3026) -- Unit 193 <[email protected]> Tue, 28 Apr 2015 16:25:58 -0400
